What is the CVSS score of CVE-2026-49298?

CVE-2026-49298 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Apache Airflow are affected by CVE-2026-49298?

Apache Airflow versions before 3.2.2 expose JWT authentication tokens through KubernetesExecutor process arguments, allowing pod-level attackers to harvest credentials and impersonate worker…. A patch is available.

How to fix or mitigate CVE-2026-49298?

Within 24 hours: audit all Apache Airflow deployments to identify instances running versions prior to 3.2.2. Within 7 days: upgrade to Apache Airflow 3.2.2 or later, and restrict process listing permissions on Kubernetes worker pods. Within 30 days: complete rollout across all environments, rotate JWT tokens, and validate that token argument passing has been eliminated from the KubernetesExecutor implementation.

Apache Airflow CVE-2026-49298

EUVD-2026-33580 HIGH

Insertion of Sensitive Information into Externally-Accessible File (CWE-538)

2026-05-31

GHSA-5j6p-jrrm-6x94

Apache Authentication Bypass

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Jun 02, 2026 - 17:25 vuln.today

Analysis Generated

Jun 02, 2026 - 17:25 vuln.today

CVSS changed

Jun 02, 2026 - 17:22 NVD

8.8 (HIGH)

Patch available

Jun 01, 2026 - 10:01 EUVD

CVE Published

May 31, 2026 - 12:45 nvd

UNKNOWN (no severity yet)

CVE Published

May 31, 2026 - 12:45 nvd

HIGH 8.8

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

8 pypi packages depend on apache-airflow-core (2 direct, 6 indirect)

Ecosystem-wide dependent count for version 3.2.2.

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Sensitive information disclosure in Apache Airflow versions prior to 3.2.2 exposes JWT authentication tokens via KubernetesExecutor command-line arguments, allowing low-privileged users with process listing access on worker pods to harvest credentials and impersonate workers against the Execution API. The flaw, addressed in PR #60108 alongside a redesign of workload/execution token lifetimes, carries a CVSS 8.8 due to high impact across confidentiality, integrity, and availability. No public exploit has been identified at time of analysis and EPSS sits at 0.02%, suggesting limited mass-exploitation activity.

Technical ContextAI

Apache Airflow's KubernetesExecutor launches worker pods by passing task execution parameters as command-line arguments to the airflow CLI inside the container. Per CWE-538 (Insertion of Sensitive Information into Externally-Accessible File or Directory), the workload JWT - used by workers to authenticate against the Execution API - was placed where it became visible through process listings (e.g., /proc/<pid>/cmdline, ps output, container introspection, or pod spec inspection via the Kubernetes API). The PR #60108 diff shows a broader hardening of the JWT scope model: distinguishing long-lived workload-scoped tokens (tied to scheduler task_queued_timeout, default 600s) from short-lived execution-scoped tokens (default 10 minutes) refreshed transparently by JWTReissueMiddleware, narrowing the blast radius if a token is leaked.

RemediationAI

Vendor-released patch: upgrade Apache Airflow to 3.2.2 or later, where the JWT token is no longer passed via worker command-line arguments and the workload/execution scope split limits token validity windows (see PR https://github.com/apache/airflow/pull/60108 and Apache thread https://lists.apache.org/thread/wo09vrks8189dzsot39rvrx3vnx102tt). Where immediate upgrade is not possible, compensating controls include restricting Kubernetes RBAC so non-admin service accounts cannot read pod specs or exec into worker pods in the Airflow namespace (side effect: blocks legitimate debugging by developers), enforcing PodSecurity restrictions and disabling shared process namespaces between sidecars and workers (side effect: may break existing observability sidecars that rely on /proc visibility), reducing scheduler task_queued_timeout to shrink the workload token validity window (side effect: more aggressive reaping of legitimately queued tasks under load), and rotating the JWT signing key after upgrade to invalidate any tokens that may have been harvested pre-patch.